PT-2025-49979 · WordPress · Profilepress

Published 2025-12-09 · Updated 2025-12-14 · CVE-2025-13642

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ProfilePress versions through 4.16.7

Description The ProfilePress plugin for WordPress is susceptible to arbitrary shortcode execution due to inadequate input sanitization of the type parameter within the form preview functionality. This allows authenticated attackers with Subscriber-level access or higher to execute arbitrary shortcodes through the pp preview form API endpoint.

Recommendations Update ProfilePress to a version newer than 4.16.7.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-13642

Affected Products

Profilepress

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-13642 · Security Note
• https://plugins.trac.wordpress.org/changeset/3408055 · Note
• https://plugins.trac.wordpress.org/browser/wp-user-avatar/trunk/src/Classes/FormPreviewHandler.php#L71 · Note
• https://plugins.trac.wordpress.org/browser/wp-user-avatar/trunk/src/Classes/FormPreviewHandler.php#L15 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4736d139-814e-4eeb-91e8-5ee41fc35a8f?source=cve · Note
• https://twitter.com/CVEnew/status/2000248707321831835 · Twitter Post